@vxil/cli 0.32.0 → 0.35.0

package/dist/_vxil-feature-configs-chatWebhook.d.ts

@@ -0,0 +1,16 @@
+/** ALERT-CHAT-DEST: the secret-name grammar of `webhooks.alerts.chatWebhook.secret`
+ *  (the secret store's own SECRET_NAME_RE, optionally `secret:`-prefixed like
+ *  every other *Ref). */
+export declare const CHAT_WEBHOOK_SECRET_PATTERN = "^(secret:)?[a-z0-9_]{1,64}$";
+/** ALERT-CHAT-DEST: where a failure-alert chat webhook may point. EXACT hosts,
+ *  plus two Microsoft Teams Workflows suffixes (each tenant gets its own
+ *  sub-domain there). Nothing else: the digest cron POSTs from vxil's own
+ *  network, so an open URL would be an SSRF / exfiltration door. */
+export declare const CHAT_WEBHOOK_HOSTS: readonly string[];
+export declare const CHAT_WEBHOOK_HOST_SUFFIXES: readonly string[];
+/** ALERT-CHAT-DEST: null when `raw` is a chat webhook URL the digest may POST
+ *  to, else a short reason. https only, default port, no credentials in the
+ *  authority, host on the allowlist. PURE — shared by the digest cron (the
+ *  enforcing check) and the dashboard (an early hint before the value is
+ *  stored write-only). */
+export declare function chatWebhookUrlError(raw: string): string | null;

package/dist/_vxil-feature-configs-cmsRules.d.ts

@@ -0,0 +1,83 @@
+import { type Static } from '@sinclair/typebox';
+/** = control-plane appgenTypes RULE_KINDS (a CI test pins the two equal). */
+export declare const CMS_RULE_KINDS: readonly ["stamp_actor", "create_by_role", "owner_only_edit", "role_gate", "archive_by_role", "state_flow", "no_self_decision", "capacity", "no_overlap"];
+export type CmsRuleKind = typeof CMS_RULE_KINDS[number];
+/** Entries in one manifest (an app compiles ≤ a few dozen; the bag stays small). */
+export declare const CMS_RULES_MAX = 64;
+/** = control-plane appgenRules MAX_LIMIT (a capacity limit is 1..this). */
+export declare const CMS_RULE_MAX_LIMIT = 100000;
+/** An App builder app id (`app_` + a 26-char Crockford ULID, any case). */
+export declare const CMS_RULE_APP_PATTERN = "^app_[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$";
+/** One rule's compiled parameters (= control-plane appgenTypes RuleParams). */
+export declare const CmsRuleParamsSchema: import("@sinclair/typebox").TObject<{
+    field: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    actor: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    roles: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"admin">, import("@sinclair/typebox").TLiteral<"member">]>>>;
+    transitions: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        from: import("@sinclair/typebox").TString;
+        to: import("@sinclair/typebox").TString;
+        role: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"admin">, import("@sinclair/typebox").TLiteral<"member">]>, import("@sinclair/typebox").TLiteral<"actor">]>>;
+    }>>>;
+    initial: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    key: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    parent: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+    parent_field: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    start: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    end: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    status: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    live: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+}>;
+export declare const CmsRuleEntrySchema: import("@sinclair/typebox").TObject<{
+    app: import("@sinclair/typebox").TString;
+    kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"owner_only_edit" | "archive_by_role" | "state_flow" | "stamp_actor" | "create_by_role" | "role_gate" | "no_self_decision" | "capacity" | "no_overlap">[]>;
+    collection: import("@sinclair/typebox").TString;
+    params: import("@sinclair/typebox").TObject<{
+        field: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        actor: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        roles: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"admin">, import("@sinclair/typebox").TLiteral<"member">]>>>;
+        transitions: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+            from: import("@sinclair/typebox").TString;
+            to: import("@sinclair/typebox").TString;
+            role: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"admin">, import("@sinclair/typebox").TLiteral<"member">]>, import("@sinclair/typebox").TLiteral<"actor">]>>;
+        }>>>;
+        initial: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        key: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        parent: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+        parent_field: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        start: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        end: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        status: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        live: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    }>;
+}>;
+export type CmsRuleEntry = Static<typeof CmsRuleEntrySchema>;
+export type CmsRuleParams = Static<typeof CmsRuleParamsSchema>;
+/** THE canonical rule key: shared by the server diff, the CLI render and
+ *  the backfill. A param change is a different key
+ *  (a removal plus an addition). The app id is compared lowercased. */
+export declare function cmsRuleKey(e: Pick<CmsRuleEntry, 'app' | 'kind' | 'collection' | 'params'>): string;
+/** The lists and fields one entry reads (its own list, and a capacity
+ *  limit's parent list + field). */
+export declare function cmsRuleReads(e: Pick<CmsRuleEntry, 'collection' | 'params'>): Array<{
+    collection: string;
+    fields: string[];
+}>;
+/** The stored entries a schema change on `collection` reads: `field` null =
+ *  a list-level change (policy, owner, access, roles, drop) — every entry on
+ *  the list or naming it as a parent; else only the entries reading that field. */
+export declare function cmsRulesReading(rules: unknown, collection: string, field: string | null): CmsRuleEntry[];
+/** One owner-facing English sentence for an entry (the CLI pull comment, the
+ *  rules_widening / destructive-ack messages). Built from the closed kind and
+ *  its validated identifiers only. */
+export declare function cmsRuleSentence(e: Pick<CmsRuleEntry, 'kind' | 'collection' | 'params'>): string;
+/** The fields-route meta-ops that change who may read or write a list (its
+ *  sharing policy): on a list a rule reads they need the destructive ack. */
+export declare const CMS_RULE_LIST_META_KEYS: readonly ["owner_field", "end_user_access", "write_roles", "org_field", "org_read_roles"];
+/** The stored entries a cms fields-route body touches on
+ *  `collection` — a policy meta-op (any entry on the list or naming it as a
+ *  parent), a field definition or a `drop_field` naming a field a rule reads.
+ *  Other bodies (a new unrelated field, retention, actions, public) touch none.
+ *  Shared by cms-v1 (the 422 ack) and /v1/apply (the plan holds the step). */
+export declare function cmsRulesTouchedByFieldBody(rules: unknown, collection: string, body: unknown): CmsRuleEntry[];

package/dist/_vxil-feature-configs-hooks.d.ts

@@ -224,4 +224,24 @@ export declare function highlightTokens(src: string): Array<{
     value: string;
     kind: HlKind;
 }>;
+/** = control-plane `appHookOwnership.APP_HOOK_RE` (the App builder ownership
+ *  marker `app_` + an app id + `_`; parity pinned by the control-plane
+ *  appgenDoors test). Only a name carrying a real App builder app id. */
+export declare const APP_OWNED_HOOK_RE: RegExp;
+/** The App builder rule kinds whose DELETE is not free for an end user
+ *  (= the non-'free' keys of control-plane `appgenDoors.DELETE_SEMANTICS`;
+ *  parity pinned by the control-plane appgenDoors test). appgenRules names a
+ *  rule's hooks `<stem><collection>_<kind>[…]`. */
+export declare const APP_DELETE_GUARDED_RULE_KINDS: readonly ["owner_only_edit", "archive_by_role", "state_flow"];
+/** The collections that carry an enabled App builder hook of a
+ *  delete-guarded rule kind. An END-USER cascade (cascade / set_null) into one
+ *  of them is refused by cms runCascade — the platform twin of the app proxy's
+ *  D5 parent-delete refusal (a guard on the child list cannot be bypassed by
+ *  deleting its parent). Structural: the hook NAME the App builder compiler
+ *  writes, never user text. A rule that compiles no write check (archive_by_role
+ *  on the proxy lane) carries the always-true `<list>_archive_by_role_delete_guard`
+ *  marker (control-plane appgenRules.withDeleteGuardMarkers), so this set equals
+ *  the lists the proxy's appgenDoors.doorsOf guards (parity pinned in the
+ *  control-plane appgenDoors test). Pure. */
+export declare function appDeleteGuardedCollections(hooks: Record<string, HookDef> | undefined): ReadonlySet<string>;
 export {};

package/dist/_vxil-feature-configs-readmodels.d.ts

@@ -81,7 +81,7 @@ export declare function validateCdcConfig(cdc: Record<string, CdcRuleLike> | und
  *  `orgField`: the workspace-scope field (null/absent = none). */
 export interface CdcCollectionGates {
     readRoleFields?: readonly string[];
-    endUserAccess?: 'readwrite' | 'read' | 'none';
+    endUserAccess?: 'readwrite' | 'read' | 'none' | 'read_all';
     ownerField?: string | null;
     orgField?: string | null;
 }

package/dist/_vxil-feature-configs.d.ts

@@ -1,11 +1,13 @@
 import { type Static, type TSchema } from '@sinclair/typebox';
 import { ACTIVITY_FEED_BUILTIN_GROUPS } from './_vxil-feature-configs-feedGroups.js';
+export { CHAT_WEBHOOK_HOSTS, CHAT_WEBHOOK_HOST_SUFFIXES, CHAT_WEBHOOK_SECRET_PATTERN, chatWebhookUrlError } from './_vxil-feature-configs-chatWebhook.js';
 export { AI_THINKING_LEVELS, geminiThinkingLevelError, minimalThinkingLevel, type GeminiThinkingLevel } from './_vxil-feature-configs-geminiThinking.js';
 export * from './_vxil-feature-configs-hooks.js';
 export * from './_vxil-feature-configs-readmodels.js';
 export * from './_vxil-feature-configs-apiState.js';
 export * from './_vxil-feature-configs-canonicalJson.js';
 export * from './_vxil-feature-configs-publicAssets.js';
+export * from './_vxil-feature-configs-cmsRules.js';
 export declare const RESERVED_CREDIT_TYPES: ReadonlySet<string>;
 /** A function binding's `retry.maxAttempts` ceiling, and the
  *  binding kinds that may carry `retry` — every lane the platform delivers
@@ -225,7 +227,7 @@ export type JobsConfig = Static<typeof JobsConfigSchema>;
 declare const OidcProviderSchema: import("@sinclair/typebox").TObject<{
     issuer: import("@sinclair/typebox").TString;
     clientId: import("@sinclair/typebox").TString;
-    clientSecretRef: import("@sinclair/typebox").TString;
+    clientSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     scopes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
     claims: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         email: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -284,7 +286,7 @@ export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
         oidc: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
             issuer: import("@sinclair/typebox").TString;
             clientId: import("@sinclair/typebox").TString;
-            clientSecretRef: import("@sinclair/typebox").TString;
+            clientSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
             scopes: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
             claims: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
                 email: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -439,6 +441,9 @@ export declare const WebhooksConfigSchema: import("@sinclair/typebox").TObject<{
         enabled: import("@sinclair/typebox").TBoolean;
         minLevel: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"warn">, import("@sinclair/typebox").TLiteral<"error">]>;
         digestMinutes: import("@sinclair/typebox").TInteger;
+        chatWebhook: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            secret: import("@sinclair/typebox").TString;
+        }>>;
     }>>;
     subscriptions: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
         target_url: import("@sinclair/typebox").TString;
@@ -454,6 +459,15 @@ export declare const CommentsConfigSchema: import("@sinclair/typebox").TObject<{
     editWindowMinutes: import("@sinclair/typebox").TInteger;
 }>;
 export type CommentsConfig = Static<typeof CommentsConfigSchema>;
+/** The most collections a project's cms may be configured for (the schema
+ *  maximum of `limits.maxCollections`); at it, "raise Max collections" is no
+ *  longer an answer. */
+export declare const CMS_MAX_COLLECTIONS_CEILING = 200;
+/** The cms query page-size defaults (the schema defaults; cmsQueryConfig's fallback). */
+export declare const CMS_QUERY_DEFAULTS: {
+    readonly maxPageSize: 100;
+    readonly defaultPageSize: 25;
+};
 export declare const CmsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     draftPublish: import("@sinclair/typebox").TBoolean;
@@ -464,10 +478,10 @@ export declare const CmsConfigSchema: import("@sinclair/typebox").TObject<{
         maxItemBytes: import("@sinclair/typebox").TInteger;
         maxItemsPerCollection: import("@sinclair/typebox").TInteger;
     }>;
-    query: import("@sinclair/typebox").TObject<{
+    query: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         maxPageSize: import("@sinclair/typebox").TInteger;
         defaultPageSize: import("@sinclair/typebox").TInteger;
-    }>;
+    }>>;
     relations: import("@sinclair/typebox").TObject<{
         maxExpandDepth: import("@sinclair/typebox").TInteger;
         maxExpandFields: import("@sinclair/typebox").TInteger;
@@ -499,8 +513,43 @@ export declare const CmsConfigSchema: import("@sinclair/typebox").TObject<{
         payload: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"ids">, import("@sinclair/typebox").TLiteral<"full">]>>;
         enabled: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
     }>>>;
+    rules: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        app: import("@sinclair/typebox").TString;
+        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"owner_only_edit" | "archive_by_role" | "state_flow" | "stamp_actor" | "create_by_role" | "role_gate" | "no_self_decision" | "capacity" | "no_overlap">[]>;
+        collection: import("@sinclair/typebox").TString;
+        params: import("@sinclair/typebox").TObject<{
+            field: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            actor: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            roles: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"admin">, import("@sinclair/typebox").TLiteral<"member">]>>>;
+            transitions: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+                from: import("@sinclair/typebox").TString;
+                to: import("@sinclair/typebox").TString;
+                role: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"admin">, import("@sinclair/typebox").TLiteral<"member">]>, import("@sinclair/typebox").TLiteral<"actor">]>>;
+            }>>>;
+            initial: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            key: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            parent: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+            parent_field: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            start: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            end: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            status: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            live: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        }>;
+    }>>>;
 }>;
 export type CmsConfig = Static<typeof CmsConfigSchema>;
+/** The resolved cms query page sizes (the bag is Optional in the type;
+ *  every persisted manifest still carries it). */
+export declare function cmsQueryConfig(config: {
+    query?: {
+        maxPageSize?: number;
+        defaultPageSize?: number;
+    } | undefined;
+} | null | undefined): {
+    maxPageSize: number;
+    defaultPageSize: number;
+};
 export declare const McpConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     exposureLevel: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"all">, import("@sinclair/typebox").TLiteral<"read-only">, import("@sinclair/typebox").TLiteral<"custom">]>;

package/dist/config.d.ts

@@ -114,13 +114,17 @@ export interface CollectionDef {
      *                  filtered delete, batch write — and a delete elsewhere
      *                  whose on_delete cascade / set_null would change a row
      *                  here) is `403 server_only`;
-     *    'none'      — no end-user reads or writes at all, even with ownerField.
+     *    'none'      — no end-user reads or writes at all, even with ownerField;
+     *    'read_all'  — every verified end user reads every row (past the
+     *                  ownerField predicate); writes stay owner-scoped as
+     *                  'readwrite' (a members board: everyone reads, each edits
+     *                  only their own).
      *  Server keys (and platform writes such as a jobs status mirror) are never
      *  affected. Stored on the collection (model data, not a config leaf) and
-     *  carried by BOTH push paths; widening ('read'/'none' → 'readwrite') needs
+     *  carried by BOTH push paths; widening (towards 'readwrite', then 'read_all') needs
      *  `vxil push --allow-destructive`. Any other value fails `vxil plan` /
      *  `vxil push` (it never falls back to 'readwrite'). */
-    endUserAccess?: 'readwrite' | 'read' | 'none';
+    endUserAccess?: 'readwrite' | 'read' | 'none' | 'read_all';
     /** Role slugs one of which a VERIFIED end user must hold to WRITE this
      *  collection (create, update, $inc, delete, publish, transaction step,
      *  filtered delete, batch write, and an end-user delete's cascade into it) —
@@ -132,6 +136,15 @@ export interface CollectionDef {
      *  a config leaf) and carried by BOTH push paths; widening (clearing, or
      *  adding a role) needs `vxil push --allow-destructive`. */
     writeRoles?: string[];
+    /** W39-3: role slugs whose VERIFIED holders MANAGE this owned collection —
+     *  they read every row (get / list / count) and may update another member's
+     *  row through the single-item PATCH; the collection's hooks still decide
+     *  which fields (every other door stays owner-scoped). Needs `ownerField`
+     *  and an end-user-writable `endUserAccess`. Absent / `[]` = none. Up to 16
+     *  slugs. Carried by BOTH push paths; adding a role widens reads and needs
+     *  `vxil push --allow-destructive`. The App builder sets `['app_manager']`
+     *  on its members apps' own-only lists while the app names managers. */
+    managerRoles?: string[];
     /** Retention in days (guide ch. 4): items created more than this many days
      *  ago are soft-deleted by the nightly sweep (recoverable for 30 days). An
      *  integer 1..3650, or `null` to keep items until deleted. ABSENT = not